GTA5[.]exe | Triage

Resubmissions

06/03/2024, 20:48

240306-zllj5aaa6y 1

Sharing

Copy URL Twitter E-mail

General

Target

GTA5.exe
Size

48.9MB
MD5

79b2f4e59fddb404ec7286b8c5290889
SHA1

ea7f5add81a0589c3fad5c44da4d12a84f276f2f
SHA256

e1e87553b6cd30823b7f56826f0c833367b5620c9ab2db2dde32e82ced9183ab
SHA512

1c7a719972928ee139f05c741a090ff4333ac35e73e3cf4e6c886ceebb2fe37cd8db91304e8e0b45fb79cf2461970a6e9d98270695b20e0e697f967782713e85
SSDEEP

786432:+R83XaZ5+zePfEIvmWTREOhqGmO8UBWG/Q9AO5+CSNuak8n5gtbnKSWk:ZaZ7UIvz+OTBWPAMSNuakDtes

Score

1^/10

Malware Config

Signatures

Files

GTA5.exe
.exe windows:5 windows x64 arch:x64

e364fbd916c0a9d25ca52afaca72db89

Code Sign

4c:17:93:4d
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

09/12/2014, 20:07

Not After

10/12/2017, 07:56

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:63:e2:e2
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

10/09/2009, 21:59

Not After

10/09/2019, 22:29

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:0e:8c:3a
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

11/11/2011, 15:41

Not After

12/11/2021, 08:51

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:17:77:2e
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

08/05/2014, 19:03

Not After

09/05/2015, 05:38

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:8a:40:2a:95:6e:ff:20:3a:ee:e4:ea:65:3f:34:ff:59:27:ac:7b
Signer

Actual PE Digest

46:8a:40:2a:95:6e:ff:20:3a:ee:e4:ea:65:3f:34:ff:59:27:ac:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

X:\gta5\titleupdate\dev_Temp\game_win64_steammaster.pdb

Imports

kernel32

GetFileInformationByHandle
ReadConsoleW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
PeekNamedPipe
GetEnvironmentStringsW
GetStartupInfoW
GetFileType
GetStdHandle
SetLastError
LoadLibraryExW
FindFirstFileExW
AreFileApisANSI
GetModuleHandleExW
GetFullPathNameW
GetFullPathNameA
GetDriveTypeW
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
DecodePointer
EncodePointer
ResetEvent
GetSystemTimeAsFileTime
GetFileTime
VerifyVersionInfoW
VerSetConditionMask
GetThreadContext
InitializeCriticalSection
CreateFileA
LoadLibraryExA
GetOverlappedResult
GetSystemDefaultUILanguage
VerifyVersionInfoA
OutputDebugStringA
SetThreadExecutionState
WerSetFlags
QueryPerformanceCounter
CreateSemaphoreA
CreateMutexA
GetSystemInfo
ReleaseMutex
ReleaseSemaphore
SetEvent
DeleteCriticalSection
OutputDebugStringW
LoadLibraryW
GetStringTypeW
GetDateFormatW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResumeThread
GetThreadPriority
SetThreadPriorityBoost
SetThreadPriority
GetThreadId
GetCurrentThreadId
GetCurrentThread
GetConsoleWindow
GetTimeFormatW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CreateProcessW
GetSystemDirectoryW
lstrcmpA
HeapSize
FreeEnvironmentStringsW
GetModuleHandleA
CreateThread
GetProcessAffinityMask
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
OpenProcess
GetCurrentProcessId
ExitProcess
CloseHandle
GetModuleFileNameA
GetModuleFileNameW
GetCommandLineA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceExA
DeleteFileW
GetFileSize
WriteFile
ReadFile
FindClose
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WaitForMultipleObjects
GetDiskFreeSpaceExW
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
WaitForSingleObject
FreeLibrary
GetProcAddress
GlobalMemoryStatusEx
LocalAlloc
LocalFree
GetSystemFirmwareTable
GetCurrentProcess
ReadProcessMemory
SetHandleInformation
GetNativeSystemInfo
CreatePipe
LoadLibraryA
CreateProcessA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetVolumeInformationA
QueryPerformanceFrequency
GetVersionExA
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
GetWriteWatch
ResetWriteWatch
VirtualQueryEx
GetModuleHandleExA
DeleteFileA
Sleep
SetFilePointer
CreateEventA
TerminateProcess
GetLastError
SetEndOfFile
SetFilePointerEx
SetFileTime
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesExW
MoveFileExW
VirtualAlloc
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery

user32

PeekMessageW
ShowWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
RegisterRawInputDevices
GetRawInputData
ClientToScreen
GetCursorPos
SetCursorPos
ShowCursor
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
GetKeyState
GetDoubleClickTime
SendMessageW
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
LockSetForegroundWindow
LoadIconA
LoadCursorA
GetParent
ClipCursor
GetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
CreateWindowExW
RegisterClassW
PostMessageA
DefWindowProcW
DispatchMessageW
TranslateMessage
GetCursorInfo
SetWindowLongPtrA
UpdateWindow
GetDesktopWindow
SystemParametersInfoA
SetWindowPos
GetClientRect
GetWindowRect
AdjustWindowRect
GetWindowLongA
MessageBoxW
GetWindowLongPtrA

steam_api64

SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamUser
SteamUtils
SteamUserStats
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamApps
SteamAPI_RunCallbacks
SteamFriends

gfsdk_shadowlib.win64

?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z
?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

dsound

ord3
ord6
ord8
ord9
ord1

bink2w64

BinkDoFrameAsyncWait
BinkDoFrameAsync
BinkSetSoundTrack
BinkSetIO
BinkSetFrameRate
BinkSetSoundSystem
BinkStartAsyncThread
BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkOpen
BinkGetFrameBuffersInfo
BinkOpenDirectSound
BinkSetMemory
BinkShouldSkip
BinkSetVolume
BinkGetKeyFrame
BinkGoto
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkRegisterFrameBuffers

ws2_32

freeaddrinfo
getaddrinfo
shutdown
sendto
select
recvfrom
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
htons
ntohs
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
inet_addr
listen
recv
send
setsockopt
socket
gethostbyname
gethostname

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

psapi

EnumProcessModules
GetModuleFileNameExA

mf

MFCreateASFProfile
MFCreateSourceResolver
MFGetService
MFCreatePresentationClock
MFCreateASFMediaSinkActivate
MFCreateASFContentInfo
MFShutdownObject

mfplat

MFGetSystemTime
MFCreateSample
MFCreateAttributes
MFShutdown
MFCreateMediaType
MFStartup
MFTEnum
MFCreateSystemTimeSource
MFInitAMMediaTypeFromMFMediaType
MFCreateMemoryBuffer

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL

propsys

PropVariantToUInt64
PropVariantToInt64
PropVariantGetStringElem
PSStringFromPropertyKey
PropVariantToStringWithDefault

crypt32

CryptQueryObject
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringA

wintrust

WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX
TxaaResolveDX

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetContext

dinput8

DirectInput8Create

xinput1_3

ord3
ord2

rpcrt4

UuidCreateSequential

shlwapi

SHStrDupW

gdi32

CreateDCA
DeleteDC
GetStockObject
ExtEscape

advapi32

RegOpenKeyExA
RegQueryValueExA
GetUserNameA
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
RegCloseKey

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteW
ShellExecuteExA
SHCreateDirectoryExW
ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
PropVariantClear
CoLockObjectExternal
CoTaskMemFree

oleaut32

SysAllocStringByteLen
VariantInit
VariantClear
SysStringLen
SysFreeString
SysAllocString

Sections

.text
Size: 23.1MB - Virtual size: 23.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 16.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 965KB - Virtual size: 965KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 855KB - Virtual size: 855KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 18.4MB - Virtual size: 18.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

e364fbd916c0a9d25ca52afaca72db89

Code Sign

4c:17:93:4dCertificate

Extended Key Usages

Key Usages

38:63:e2:e2Certificate

Key Usages

4c:0e:8c:3aCertificate

Key Usages

4c:17:77:2eCertificate

Extended Key Usages

Key Usages

46:8a:40:2a:95:6e:ff:20:3a:ee:e4:ea:65:3f:34:ff:59:27:ac:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

steam_api64

gfsdk_shadowlib.win64

version

dsound

bink2w64

ws2_32

winmm

psapi

mf

mfplat

msdmo

mfreadwrite

propsys

crypt32

wintrust

wtsapi32

d3d9

d3dcompiler_43

gfsdk_txaa_alpharesolve.win64

imm32

dinput8

xinput1_3

rpcrt4

shlwapi

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 23.1MB - Virtual size: 23.1MB

BINK Size: 3KB - Virtual size: 3KB

BINKBSS Size: - Virtual size: 96B

.rdata Size: 3.4MB - Virtual size: 3.4MB

.data Size: 2.0MB - Virtual size: 16.1MB

.pdata Size: 965KB - Virtual size: 965KB

.tls Size: 2KB - Virtual size: 2KB

BINKCONS Size: 512B - Virtual size: 512B

.rsrc Size: 183KB - Virtual size: 183KB

.reloc Size: 855KB - Virtual size: 855KB

.text Size: 18.4MB - Virtual size: 18.4MB

4c:17:93:4d
Certificate

38:63:e2:e2
Certificate

4c:0e:8c:3a
Certificate

4c:17:77:2e
Certificate

46:8a:40:2a:95:6e:ff:20:3a:ee:e4:ea:65:3f:34:ff:59:27:ac:7b
Signer

.text
Size: 23.1MB - Virtual size: 23.1MB

BINK
Size: 3KB - Virtual size: 3KB

BINKBSS
Size: - Virtual size: 96B

.rdata
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 2.0MB - Virtual size: 16.1MB

.pdata
Size: 965KB - Virtual size: 965KB

.tls
Size: 2KB - Virtual size: 2KB

BINKCONS
Size: 512B - Virtual size: 512B

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 855KB - Virtual size: 855KB

.text
Size: 18.4MB - Virtual size: 18.4MB